diff --git a/infrastructure/metallb/kustomization.yaml b/infrastructure/metallb/kustomization.yaml
index bfc20a64..bc15ceec 100644
--- a/infrastructure/metallb/kustomization.yaml
+++ b/infrastructure/metallb/kustomization.yaml
@@ -5,3 +5,4 @@ resources:
   - namespace.yaml
   - helmrelease.yaml
   - ippool.yaml
+  - lan-ai-pool.yaml
diff --git a/infrastructure/metallb/lan-ai-pool.yaml b/infrastructure/metallb/lan-ai-pool.yaml
new file mode 100644
index 00000000..db4f7ea7
--- /dev/null
+++ b/infrastructure/metallb/lan-ai-pool.yaml
@@ -0,0 +1,19 @@
+# infrastructure/metallb/lan-ai-pool.yaml
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: lan-ai-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 192.168.22.50/32
+  autoAssign: false
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: lan-ai-adv
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+    - lan-ai-pool
diff --git a/infrastructure/traefik/kustomization.yaml b/infrastructure/traefik/kustomization.yaml
index d2ead9a6..98ff13fc 100644
--- a/infrastructure/traefik/kustomization.yaml
+++ b/infrastructure/traefik/kustomization.yaml
@@ -14,3 +14,4 @@ resources:
   - clusterrolebinding.yaml
   - service.yaml
   - traefik-service-lb.yaml
+  - traefik-service-lan.yaml
diff --git a/infrastructure/traefik/traefik-service-lan.yaml b/infrastructure/traefik/traefik-service-lan.yaml
new file mode 100644
index 00000000..6b5b891c
--- /dev/null
+++ b/infrastructure/traefik/traefik-service-lan.yaml
@@ -0,0 +1,24 @@
+# infrastructure/traefik/traefik-service-lan.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-lan
+  namespace: traefik
+  annotations:
+    metallb.universe.tf/address-pool: lan-ai-pool
+spec:
+  type: LoadBalancer
+  loadBalancerClass: metallb
+  loadBalancerIP: 192.168.22.50
+  # The shared public Service masks source addresses. Keep the LAN path
+  # separate so ingress allowlists see the actual client, not a node IP.
+  externalTrafficPolicy: Local
+  loadBalancerSourceRanges:
+    - 192.168.22.0/24
+  ports:
+    - name: websecure
+      port: 443
+      targetPort: websecure
+      protocol: TCP
+  selector:
+    app: traefik